In the Linux kernel, the following vulnerability has been resolved:
media: usbtv: Lock resolution while streaming
When an program is streaming (ffplay) and another program (qv4l2) changes the TV standard from NTSC to PAL, the kernel crashes due to trying to copy to unmapped memory.
Changing from NTSC to PAL increases the resolution in the usbtv struct, but the video plane buffer isn't adjusted, so it overflows.
[hverkuil: call vb2isbusy instead of vb2isstreaming]
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5427dda195d6baf23028196fd55a0c90f66ffa61",
"digest": {
"function_hash": "144955070150715240134025506716899174333",
"length": 475.0
},
"target": {
"function": "usbtv_configure_for_norm",
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-0400abe5",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef9b3c22405192afaa279077ddd45a51db90b83d",
"digest": {
"line_hashes": [
"192664758985814455037777087391036201028",
"100960000728008019007582407159961963776",
"221939172047836017649497438921595045898",
"272919001262307776874770974512763500842"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-2beda73c",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f886d21e235c4bd038cb20f6696084304197ab3",
"digest": {
"function_hash": "144955070150715240134025506716899174333",
"length": 475.0
},
"target": {
"function": "usbtv_configure_for_norm",
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-3b489d21",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@9f886d21e235c4bd038cb20f6696084304197ab3",
"digest": {
"line_hashes": [
"192664758985814455037777087391036201028",
"100960000728008019007582407159961963776",
"221939172047836017649497438921595045898",
"272919001262307776874770974512763500842"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-4048fc49",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d83d0b5ae5045a7a246ed116b5f6c688a12f9e9",
"digest": {
"function_hash": "144955070150715240134025506716899174333",
"length": 475.0
},
"target": {
"function": "usbtv_configure_for_norm",
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-56ab9112",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ef9b3c22405192afaa279077ddd45a51db90b83d",
"digest": {
"function_hash": "144955070150715240134025506716899174333",
"length": 475.0
},
"target": {
"function": "usbtv_configure_for_norm",
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-619e3878",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee7bade8b9244834229b12b6e1e724939bedd484",
"digest": {
"line_hashes": [
"192664758985814455037777087391036201028",
"100960000728008019007582407159961963776",
"221939172047836017649497438921595045898",
"272919001262307776874770974512763500842"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-76832d32",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3d75524e10021aa5c223d94da4996640aed46c0",
"digest": {
"function_hash": "144955070150715240134025506716899174333",
"length": 475.0
},
"target": {
"function": "usbtv_configure_for_norm",
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-8af5dad5",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c3d75524e10021aa5c223d94da4996640aed46c0",
"digest": {
"line_hashes": [
"192664758985814455037777087391036201028",
"100960000728008019007582407159961963776",
"221939172047836017649497438921595045898",
"272919001262307776874770974512763500842"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-918125d5",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5427dda195d6baf23028196fd55a0c90f66ffa61",
"digest": {
"line_hashes": [
"192664758985814455037777087391036201028",
"100960000728008019007582407159961963776",
"221939172047836017649497438921595045898",
"272919001262307776874770974512763500842"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-d04f3517",
"signature_version": "v1",
"signature_type": "Line"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ee7bade8b9244834229b12b6e1e724939bedd484",
"digest": {
"function_hash": "126838252639882486605180285276587082009",
"length": 469.0
},
"target": {
"function": "usbtv_configure_for_norm",
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-e3d694b2",
"signature_version": "v1",
"signature_type": "Function"
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@3d83d0b5ae5045a7a246ed116b5f6c688a12f9e9",
"digest": {
"line_hashes": [
"192664758985814455037777087391036201028",
"100960000728008019007582407159961963776",
"221939172047836017649497438921595045898",
"272919001262307776874770974512763500842"
],
"threshold": 0.9
},
"target": {
"file": "drivers/media/usb/usbtv/usbtv-video.c"
},
"id": "CVE-2025-39714-efe4e197",
"signature_version": "v1",
"signature_type": "Line"
}
]